RE: Disclaimers and Signatures

[Don Andrews]

Your phone doesn't sync deletes???

-Original Message-
From: Campbell, Rob [mailto:rob_campb...@centraltechnology.net] 
Sent: Thursday, February 23, 2012 5:34 PM
To: MS-Exchange Admin Issues
Subject: RE: Disclaimers and Signatures

That doesn't help my phone.

-Original Message-
From: Michael B. Smith 
Sent: Thursday, February 23, 2012 7:27 PM
To: MS-Exchange Admin Issues 
Subject: RE: Disclaimers and Signatures


Mailbox.

I wouldn't presume to make the assumption for my other mailbox users. :-P

-Original Message-
From: Campbell, Rob [mailto:rob_campb...@centraltechnology.net]
Sent: Thursday, February 23, 2012 8:19 PM
To: MS-Exchange Admin Issues
Subject: RE: Disclaimers and Signatures

Mailbox or transport?

-Original Message-
From: Michael B. Smith 
Sent: Thursday, February 23, 2012 7:11 PM
To: MS-Exchange Admin Issues 
Subject: RE: Disclaimers and Signatures


I don't see them anymore. I wrote a couple of rules that delete them.

-Original Message-
From: Campbell, Rob [mailto:rob_campb...@centraltechnology.net]
Sent: Thursday, February 23, 2012 7:57 PM
To: MS-Exchange Admin Issues
Subject: RE: Disclaimers and Signatures

I should write an EWS script that runs as a scheduled task and sends an email 
to the list and deletes all the OOFs before I get to work.

-Original Message-
From: Kurt Buff 
Sent: Thursday, February 23, 2012 6:17 PM
To: MS-Exchange Admin Issues 
Subject: Re: Disclaimers and Signatures


Oh, you spoilsport.

Don't you think those fancy .sigs with the moving graphics embedded in them are 
the bees knees?

Next you'll be saying you didn't like the hamster dance web site, back in the 
'90s, or lolcats/cheezburger nowadays.

Meanie...

Kurt

On Thu, Feb 23, 2012 at 14:26, Don Andrews  wrote:
> +1
>
>
>
> 
>
> Neatsy cutesy signatures bad on internal email, unforgivable on external.
>
> 
>
>
>
> From: pramatow...@mediageneral.com
> [mailto:pramatow...@mediageneral.com]
> Sent: Thursday, February 23, 2012 2:15 PM
> To: MS-Exchange Admin Issues
>
>
> Subject: Re: Disclaimers and Signatures
>
>
>
> Don't know, maybe its just Symantec some sigs with fancy bits get
> caught here as "unscannable" and get the message tossed.
> /.02¥ worth
>
> Blackberry
>
>
> From: Richard Stovall [mailto:rich...@gmail.com]
> Sent: Thursday, February 23, 2012 03:56 PM
> To: MS-Exchange Admin Issues 
> Subject: Re: Disclaimers and Signatures
>
>
> Signatures mostly, but the desire to embed graphics in HTML-formatted
> ones is high on the list of requirements, so vanilla transport rules are out.
>
> On Thu, Feb 23, 2012 at 3:12 PM, Jonathan Link
> 
> wrote:
>
> What exactly is the boss wanting to do?
>
>
>
> Before I took my present position, the previous person bought DisclaimIt.
> There is a 2010 version.  And it works quite well on 2003.
>
> On Thu, Feb 23, 2012 at 2:45 PM, Richard Stovall  wrote:
>
> Is anyone using CodeTwo's Exchange Rules product?  Any thoughts to share?
> Any other alternatives I should look at?  We're on Exchange 2010 and
> using transport rules isn't quite flexible enough for what the boss wants to 
> do.
>
>
>
> Thanks,
> RS
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
>
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


**
Note:
The information contained in this message may be privileged and confidential 
and protected from disclosure.  If the reader of this message is not the 
intended recipient, or an employee or agent responsible for delivering this 
message to the intended recipient, you are hereby notified that any 
dissemination, distribution or copying of this communication is strictly 
prohibited. If you have received this communication in error, please notify us 
immediately by replying to the message and deleting it from your computer.

RE: internal spam

[Randal, Phil]

The devil's in the detail?

How are the infected boxes sending the emails?  Via SMTP?  If so, firewall it 
and configure Exchange SMTP connectors so that only authorised hosts can 
connect to your email hubs, SMTP relays, and SMTP servers in the outside world..

Cheers,

Phil
--
Phil Randal
Infrastructure Engineer
Hoople Ltd | Thorn Office Centre | Hereford HR2 6JT
Tel: 01432 260415 | Email: phil.ran...@hoopleltd.co.uk

From: Sharp, Kevin [mailto:kevin.sh...@usask.ca]
Sent: 24 February 2012 17:20
To: MS-Exchange Admin Issues
Subject: internal spam

I'm wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email...essentially an internal spam attack.

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

We notice this when the email starts piling up, and action can be taken 
then..but I'm wondering if there is some software or method that might have 
some more smarts.

We've had numerous incidents but so farnot an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

I've looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

Thanks

Kevin Sharp



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

"Any opinion expressed in this e-mail or any attached files are those of the 
individual and not necessarily those of Hoople Ltd. You should be aware that 
Hoople Ltd. monitors its email service. This e-mail and any attached files are 
confidential and intended solely for the use of the addressee. This 
communication may contain material protected by law from being passed on. If 
you are not the intended recipient and have received this e-mail in error, you 
are advised that any use, dissemination, forwarding, printing or copying of 
this e-mail is strictly prohibited. If you have received this e-mail in error 
please contact the sender immediately and destroy all copies of it.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: internal spam

[Campbell, Rob]

Maybe easier said than done if the clients are using POP.

From: Randal, Phil [mailto:phil.ran...@hoopleltd.co.uk]
Sent: Friday, February 24, 2012 11:30 AM
To: MS-Exchange Admin Issues
Subject: RE: internal spam

The devil's in the detail?

How are the infected boxes sending the emails?  Via SMTP?  If so, firewall it 
and configure Exchange SMTP connectors so that only authorised hosts can 
connect to your email hubs, SMTP relays, and SMTP servers in the outside world..

Cheers,

Phil
--
Phil Randal
Infrastructure Engineer
Hoople Ltd | Thorn Office Centre | Hereford HR2 6JT
Tel: 01432 260415 | Email: 
phil.ran...@hoopleltd.co.uk

From: Sharp, Kevin 
[mailto:kevin.sh...@usask.ca]
Sent: 24 February 2012 17:20
To: MS-Exchange Admin Issues
Subject: internal spam

I'm wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email...essentially an internal spam attack.

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

We notice this when the email starts piling up, and action can be taken 
then..but I'm wondering if there is some software or method that might have 
some more smarts.

We've had numerous incidents but so farnot an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

I've looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

Thanks

Kevin Sharp



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist
"Any opinion expressed in this e-mail or any attached files are those of the 
individual and not necessarily those of Hoople Ltd. You should be aware that 
Hoople Ltd. monitors its email service. This e-mail and any attached files are 
confidential and intended solely for the use of the addressee. This 
communication may contain material protected by law from being passed on. If 
you are not the intended recipient and have received this e-mail in error, you 
are advised that any use, dissemination, forwarding, printing or copying of 
this e-mail is strictly prohibited. If you have received this e-mail in error 
please contact the sender immediately and destroy all copies of it.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist
**
Note: 
The information contained in this message may be privileged and confidential 
and 
protected from disclosure.  If the reader of this message is not the intended  
recipient, or an employee or agent responsible for delivering this message to  
the intended recipient, you are hereby notified that any dissemination,   
distribution or copying of this communication is strictly prohibited. If you  
have received this communication in error, please notify us immediately by  
replying to the message and deleting it from your computer. 
**

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: internal spam

[Young, Darren]

We're implementing outbound scanning. All the Exchange servers will be sending 
through our Barracuda units.

We rate limit as well and use Return Path to monitor our external MTA addresses.

I don't think there's any way to guarantee stopping it, just mitigate as much 
as possible.

From: Sharp, Kevin 
[mailto:kevin.sh...@usask.ca]
Sent: 24 February 2012 17:20
To: MS-Exchange Admin Issues
Subject: internal spam

I'm wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email...essentially an internal spam attack.

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

We notice this when the email starts piling up, and action can be taken 
then..but I'm wondering if there is some software or method that might have 
some more smarts.

We've had numerous incidents but so farnot an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

I've looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

Thanks

Kevin Sharp



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist
"Any opinion expressed in this e-mail or any attached files are those of the 
individual and not necessarily those of Hoople Ltd. You should be aware that 
Hoople Ltd. monitors its email service. This e-mail and any attached files are 
confidential and intended solely for the use of the addressee. This 
communication may contain material protected by law from being passed on. If 
you are not the intended recipient and have received this e-mail in error, you 
are advised that any use, dissemination, forwarding, printing or copying of 
this e-mail is strictly prohibited. If you have received this e-mail in error 
please contact the sender immediately and destroy all copies of it.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: internal spam

[Beckers, Shawn (IT Services)]

We use a PowerShell script to monitor the tracking logs and are alerted if a 
user sends a specified number of messages within a specified period of time.  
Not a perfect solution.  I know others do something similar, but in addition to 
being alerted, disable the user's ability to send messages.

Nuno Mota just published a series of articles on preventing auto-reply storms 
over at MSExchange.org (link is below).  They include a script and the use of a 
transport rule to do this.  With some tweaking, these could probably also be 
applied to cut off email coming from a compromised account.

http://www.msexchange.org/articles_tutorials/exchange-server-2010/monitoring-operations/preventing-autoreply-storms-part1.html


From: Sharp, Kevin [mailto:kevin.sh...@usask.ca]
Sent: Friday, February 24, 2012 11:20 AM
To: MS-Exchange Admin Issues
Subject: internal spam

I'm wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email...essentially an internal spam attack.

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

We notice this when the email starts piling up, and action can be taken 
then..but I'm wondering if there is some software or method that might have 
some more smarts.

We've had numerous incidents but so farnot an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

I've looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

Thanks

Kevin Sharp



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005

[Kurt Buff]

All,

I'm wondering if anyone has run into a similar situation, or has some
insight into what else I can do.

This started about 4 days ago - I've got the above eventid logging
about every 5 minutes, but only for one user. Possibly important
detail: This user is a road warrior, and is using an HTC Thunderbolt
with Active Sync.

The very first link on google
(http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/c275b561-7b88-4d7a-ba16-2956a88d43a1)
discusses this exact issue, but the hotfix mentioned didn't in my case
fix this issue.

I've applied the hotfix Exchange2003-KB943721-x86.exe, but that did
not solve the problem - it restarted the services, but the entries
still accumulate.

The error code that's listed in the event log is different than what's
showing in the KB article, however. I'm seeing 0x80004005, which is
not disucssed.

Looking through the rest of the google entries, I find no better suggestions.

What I'm doing now is asking him to turn off his Calendar sync for an
hour, and notify me when he does, so that I can check whether it's the
phone that's causing the issue.

Kurt

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Selective Wipe of ActiveSync devices

[Heaton, Joseph@DFG]

What do you use to manage your devices?  What OS platform are they?

Joe Heaton
ITB - Windows Server Support

From: pramatow...@mediageneral.com [mailto:pramatow...@mediageneral.com]
Sent: Thursday, February 23, 2012 1:14 PM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

I should say it's not common here  ~900 EAS devices (and growing) we've had 
maybe 20 or so people not like it, and only 3 decide not to do it.
Haven't had a single complaint with actually wiping a device.

From: Guyer, Donald [mailto:dgu...@che.org]
Sent: Thursday, February 23, 2012 3:41 PM
To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

Not in the 4 weeks that I've been here and I haven't heard any stories of such.


Regards,

Don Guyer
Directory and Messaging Services
Catholic Health East, ITSS

From: Adm [mailto:sms...@gmail.com]
Sent: Thursday, February 23, 2012 2:56 PM
To: MS-Exchange Admin Issues
Subject: Re: Selective Wipe of ActiveSync devices

Do any of you get push back form the users that they don't want "Big Brother" 
to have control?
We've had many decline to use our Mobile Device Mgmt app and therefore not have 
mobile access to their mail.
On Thu, Feb 23, 2012 at 2:05 PM, Guyer, Donald 
mailto:dgu...@che.org>> wrote:
In the case of a personal device, we have them sign a waiver stating we can 
wipe it if necessary, including their personal data/apps.

What happens if an admin has critical system info stored somewhere else on the 
phone, other than email?

Just sayin...

Regards,

Don Guyer
Directory and Messaging Services
Catholic Health East, ITSS

From: Eric Wittersheim 
[mailto:ewittersh...@aasmnet.org]
Sent: Thursday, February 23, 2012 12:41 PM

To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

Yes, I am only looking to wipe the mail part of the phone.  With Exchange 2003 
I also have the option to wipe completely as well but management doesn't want 
to wipe users phones of all their personal data/apps.

From: Chinnery, Paul [mailto:pa...@mmcwm.com]
Sent: Thursday, February 23, 2012 11:01 AM

To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

If you mean only wiping certain parts of a phone, for instance, it was posted a 
while back on this forum that the iPhone would be wiped completely if done 
through Exchange.  We're using Exchange 07 and as part of the user's agreement 
with us to enable Activesync, they give us the right to completely wipe the 
phone if it becomes lost or stolen.

From: Eric Wittersheim [mailto:ewittersh...@aasmnet.org]
Sent: Thursday, February 23, 2012 10:52 AM
To: MS-Exchange Admin Issues
Subject: Selective Wipe of ActiveSync devices

Good morning all,

What is everyone using for their corp. environment to do selective wipes of 
ActiveSync devices that aren't owned by the company? I'm currently running 
Exchange 2003 SP2 with plans to upgrade to 2010 later this year.  With that in 
mind would I be better off upgrading to Exch 2010 first?

Eric Wittersheim
Network Administrator
American Academy of Sleep Medicine
2510 N. Frontage Road
Darien, IL. 60561

Thank you for your membership support! To continue receiving the value of AASM 
membership through 2012, renew online! www.aasmnet.org
{*}

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist
Confidentiality Notice:
This e-mail, including any attachments is the
property of Catholic Health East and is intended
for the sole use of the intended recipient(s).
It may contain information that is privileged and
confidential.  Any unauthorized review, use,
disclosure, or distribution is prohibited. If you are
not the intended recipient, please delete this message, and
reply to the sender regarding the error in a separate email.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist



--
smsadm

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com

RE: Exchange 2010 Litigation hold

[Heaton, Joseph@DFG]

So, 2 days later now, and I still don't have the message that I'm on litigation 
hold on the backstage screen.  Any ideas why this wouldn't have happened?

Joe Heaton
ITB - Windows Server Support

From: Joseph Heaton [mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 10:14 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Awesome.  As always, thank you so very much.

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:mich...@smithcons.com]
Sent: Wednesday, February 22, 2012 10:09 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Quote:

Although litigation hold is processed by Exchange in that period, the 
litigation hold comment does not show up in Outlook 2010 until the MFA has 
processed the mailbox. Depending on the assistant's work cycle, it may take as 
long as 1 day (the default work cycle configuration on Exchange 2010) for the 
comment to be displayed in Outlook. To make the comment show up sooner, you can 
manually kick off the assistant against a mailbox.

Start-ManagedFolderAssistant "Mailbox User"

To have the assistant process multiple mailboxes, you'll need to pipe output 
from the Get-Mailbox cmdlet, which can use recipient filters to filter 
mailboxes, or use distribution group membership.

http://blogs.technet.com/b/exchange/archive/2011/08/16/retention-hold-and-litigation-hold-in-exchange-2010.aspx

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:56 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

I am in cached mode.  When I set the hold, I got a message saying it could take 
up to 60 minutes, but it's been a couple of hours now, I believe.  Does it show 
up at the top, after clicking the File tab, or...?

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:michael@smithconscom]
Sent: Wednesday, February 22, 2012 9:41 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Are you in cached mode?

My memory is this can take several hours, but I haven't tested it since the 
last article I wrote on it.

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:30 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 Litigation hold

We're running Exch 2010, SP1

In our migration efforts from Groupwise, one question that has come up is 
litigation hold.  So, I've been doing some research, and understand the 
workings of it, but I have a question about the notification.  I've placed 
myself on litigation hold, and typed in a message in the notes field.  This is 
supposed to show up in the backstage area of Outlook 2010, which I'm running as 
my client.  It's been well over an hour, and I'm not seeing anything in the 
backstage area.  Am I being blind, or is there something I haven't done 
correctly?

Joseph L. Heaton
Staff Information Systems Analyst
Windows Server Support
Information Technology Branch
Department of Fish and Game
1807 13th Street, Suite 201
Sacramento, CA  95811
(916) 323-1284


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Selective Wipe of ActiveSync devices

[PRamatowski]

E2010 mainly, and a smattering of GOOD. Worst part is when someone loses the 
dev, first thing they do is change the password, then call. Or someone quits, 
HD changes passwords when they're not supposed to. But so it goes:)

Blackberry

From: Heaton, Joseph@DFG [mailto:jhea...@dfg.ca.gov]
Sent: Friday, February 24, 2012 01:38 PM
To: MS-Exchange Admin Issues 
Subject: RE: Selective Wipe of ActiveSync devices

What do you use to manage your devices?  What OS platform are they?

Joe Heaton
ITB – Windows Server Support

From: pramatow...@mediageneral.com [mailto:pramatow...@mediageneral.com]
Sent: Thursday, February 23, 2012 1:14 PM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

I should say it’s not common here  ~900 EAS devices (and growing) we’ve had 
maybe 20 or so people not like it, and only 3 decide not to do it.
Haven’t had a single complaint with actually wiping a device.

From: Guyer, Donald [mailto:dgu...@che.org]
Sent: Thursday, February 23, 2012 3:41 PM
To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

Not in the 4 weeks that I’ve been here and I haven’t heard any stories of such.


Regards,

Don Guyer
Directory and Messaging Services
Catholic Health East, ITSS

From: Adm [mailto:sms...@gmail.com]
Sent: Thursday, February 23, 2012 2:56 PM
To: MS-Exchange Admin Issues
Subject: Re: Selective Wipe of ActiveSync devices

Do any of you get push back form the users that they don't want "Big Brother" 
to have control?
We've had many decline to use our Mobile Device Mgmt app and therefore not have 
mobile access to their mail.
On Thu, Feb 23, 2012 at 2:05 PM, Guyer, Donald 
mailto:dgu...@che.org>> wrote:
In the case of a personal device, we have them sign a waiver stating we can 
wipe it if necessary, including their personal data/apps.

What happens if an admin has critical system info stored somewhere else on the 
phone, other than email?

Just sayin…

Regards,

Don Guyer
Directory and Messaging Services
Catholic Health East, ITSS

From: Eric Wittersheim 
[mailto:ewittersh...@aasmnet.org]
Sent: Thursday, February 23, 2012 12:41 PM

To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

Yes, I am only looking to wipe the mail part of the phone.  With Exchange 2003 
I also have the option to wipe completely as well but management doesn’t want 
to wipe users phones of all their personal data/apps.

From: Chinnery, Paul [mailto:pa...@mmcwm.com]
Sent: Thursday, February 23, 2012 11:01 AM

To: MS-Exchange Admin Issues
Subject: RE: Selective Wipe of ActiveSync devices

If you mean only wiping certain parts of a phone, for instance, it was posted a 
while back on this forum that the iPhone would be wiped completely if done 
through Exchange.  We're using Exchange 07 and as part of the user's agreement 
with us to enable Activesync, they give us the right to completely wipe the 
phone if it becomes lost or stolen.

From: Eric Wittersheim [mailto:ewittersh...@aasmnet.org]
Sent: Thursday, February 23, 2012 10:52 AM
To: MS-Exchange Admin Issues
Subject: Selective Wipe of ActiveSync devices

Good morning all,

What is everyone using for their corp. environment to do selective wipes of 
ActiveSync devices that aren’t owned by the company? I’m currently running 
Exchange 2003 SP2 with plans to upgrade to 2010 later this year.  With that in 
mind would I be better off upgrading to Exch 2010 first?

Eric Wittersheim
Network Administrator
American Academy of Sleep Medicine
2510 N. Frontage Road
Darien, IL. 60561

Thank you for your membership support! To continue receiving the value of AASM 
membership through 2012, renew online! www.aasmnet.org
{*}

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist
Confidentiality Notice:
This e-mail, including any attachments is the
property of Catholic Health East and is intended
for the sole use of the intended recipient(s).
It may contain information that is privileged and
confidential.  Any unauthorized review, use,
disclosure, or distribution is prohibited. If you are
not the intended recipient, please delete this message, and
reply to the sender regarding the error in a separate e

RE: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005

[Michael B. Smith]

Seen this?

http://blogs.technet.com/b/exchange/archive/2012/02/22/calcheck-the-outlook-calendar-checking-tool.aspx


-Original Message-
From: Kurt Buff [mailto:kurt.b...@gmail.com] 
Sent: Friday, February 24, 2012 1:17 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005

All,

I'm wondering if anyone has run into a similar situation, or has some insight 
into what else I can do.

This started about 4 days ago - I've got the above eventid logging about every 
5 minutes, but only for one user. Possibly important
detail: This user is a road warrior, and is using an HTC Thunderbolt with 
Active Sync.

The very first link on google
(http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/c275b561-7b88-4d7a-ba16-2956a88d43a1)
discusses this exact issue, but the hotfix mentioned didn't in my case fix this 
issue.

I've applied the hotfix Exchange2003-KB943721-x86.exe, but that did not solve 
the problem - it restarted the services, but the entries still accumulate.

The error code that's listed in the event log is different than what's showing 
in the KB article, however. I'm seeing 0x80004005, which is not disucssed.

Looking through the rest of the google entries, I find no better suggestions.

What I'm doing now is asking him to turn off his Calendar sync for an hour, and 
notify me when he does, so that I can check whether it's the phone that's 
causing the issue.

Kurt

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange 2010 Litigation hold

[Michael B. Smith]

Is the MFA scheduled to run? Have you run it manually?

From: Heaton, Joseph@DFG [mailto:jhea...@dfg.ca.gov]
Sent: Friday, February 24, 2012 1:44 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

So, 2 days later now, and I still don't have the message that I'm on litigation 
hold on the backstage screen.  Any ideas why this wouldn't have happened?

Joe Heaton
ITB - Windows Server Support

From: Joseph Heaton 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 10:14 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Awesome.  As always, thank you so very much.

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:mich...@smithcons.com]
Sent: Wednesday, February 22, 2012 10:09 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Quote:

Although litigation hold is processed by Exchange in that period, the 
litigation hold comment does not show up in Outlook 2010 until the MFA has 
processed the mailbox. Depending on the assistant's work cycle, it may take as 
long as 1 day (the default work cycle configuration on Exchange 2010) for the 
comment to be displayed in Outlook. To make the comment show up sooner, you can 
manually kick off the assistant against a mailbox.

Start-ManagedFolderAssistant "Mailbox User"

To have the assistant process multiple mailboxes, you'll need to pipe output 
from the Get-Mailbox cmdlet, which can use recipient filters to filter 
mailboxes, or use distribution group membership.

http://blogs.technet.com/b/exchange/archive/2011/08/16/retention-hold-and-litigation-hold-in-exchange-2010.aspx

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:56 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

I am in cached mode.  When I set the hold, I got a message saying it could take 
up to 60 minutes, but it's been a couple of hours now, I believe.  Does it show 
up at the top, after clicking the File tab, or...?

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:michael@smithconscom]
Sent: Wednesday, February 22, 2012 9:41 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Are you in cached mode?

My memory is this can take several hours, but I haven't tested it since the 
last article I wrote on it.

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:30 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 Litigation hold

We're running Exch 2010, SP1

In our migration efforts from Groupwise, one question that has come up is 
litigation hold.  So, I've been doing some research, and understand the 
workings of it, but I have a question about the notification.  I've placed 
myself on litigation hold, and typed in a message in the notes field.  This is 
supposed to show up in the backstage area of Outlook 2010, which I'm running as 
my client.  It's been well over an hour, and I'm not seeing anything in the 
backstage area.  Am I being blind, or is there something I haven't done 
correctly?

Joseph L. Heaton
Staff Information Systems Analyst
Windows Server Support
Information Technology Branch
Department of Fish and Game
1807 13th Street, Suite 201
Sacramento, CA  95811
(916) 323-1284


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manag

Re: Selective Wipe of ActiveSync devices

[Adm]

We use Zenprise to manage the devices.
Our devices are anything and everything.
Sometimes this can be a nightmare.
YMMV

On Fri, Feb 24, 2012 at 1:38 PM, Heaton, Joseph@DFG wrote:

>  What do you use to manage your devices?  What OS platform are they?
>
> ** **
>
> Joe Heaton
>
> ITB – Windows Server Support
>
> ** **
>
> *From:* pramatow...@mediageneral.com [mailto:pramatow...@mediageneral.com]
>
> *Sent:* Thursday, February 23, 2012 1:14 PM
> *To:* Heaton, Joseph@DFG; MS-Exchange Admin Issues
>
> *Subject:* RE: Selective Wipe of ActiveSync devices
>
>  ** **
>
> I should say it’s not common here  ~900 EAS devices (and growing) we’ve
> had maybe 20 or so people not like it, and only 3 decide not to do it.
>
> Haven’t had a single complaint with actually wiping a device.
>
> ** **
>
> *From:* Guyer, Donald [mailto:dgu...@che.org]
> *Sent:* Thursday, February 23, 2012 3:41 PM
> *To:* MS-Exchange Admin Issues
> *Subject:* RE: Selective Wipe of ActiveSync devices
>
> ** **
>
> Not in the 4 weeks that I’ve been here and I haven’t heard any stories of
> such.
>
> ** **
>
> ** **
>
> Regards,
>
> ** **
>
> Don Guyer
>
> Directory and Messaging Services
> Catholic Health East, ITSS
>
> ** **
>
> *From:* Adm [mailto:sms...@gmail.com]
> *Sent:* Thursday, February 23, 2012 2:56 PM
> *To:* MS-Exchange Admin Issues
> *Subject:* Re: Selective Wipe of ActiveSync devices
>
> ** **
>
> Do any of you get push back form the users that they don't want "Big
> Brother" to have control?
> We've had many decline to use our Mobile Device Mgmt app and therefore not
> have mobile access to their mail.
>
> On Thu, Feb 23, 2012 at 2:05 PM, Guyer, Donald  wrote:
>
> In the case of a personal device, we have them sign a waiver stating we
> can wipe it if necessary, including their personal data/apps.
>
>  
>
> What happens if an admin has critical system info stored somewhere else on
> the phone, other than email?
>
>  
>
> Just sayin…
>
>  
>
> Regards,
>
>  
>
> Don Guyer
>
> Directory and Messaging Services
> Catholic Health East, ITSS
>
>  
>
> *From:* Eric Wittersheim [mailto:ewittersh...@aasmnet.org]
> *Sent:* Thursday, February 23, 2012 12:41 PM
>
>
> *To:* MS-Exchange Admin Issues
> *Subject:* RE: Selective Wipe of ActiveSync devices
>
>  
>
> Yes, I am only looking to wipe the mail part of the phone.  With Exchange
> 2003 I also have the option to wipe completely as well but management
> doesn’t want to wipe users phones of all their personal data/apps.
>
>  
>
> *From:* Chinnery, Paul [mailto:pa...@mmcwm.com]
> *Sent:* Thursday, February 23, 2012 11:01 AM
>
>
> *To:* MS-Exchange Admin Issues
> *Subject:* RE: Selective Wipe of ActiveSync devices
>
>  
>
> If you mean only wiping certain parts of a phone, for instance, it was
> posted a while back on this forum that the iPhone would be wiped completely
> if done through Exchange.  We're using Exchange 07 and as part of the
> user's agreement with us to enable Activesync, they give us the right to
> completely wipe the phone if it becomes lost or stolen.
>
>  
>
> *From:* Eric Wittersheim 
> [mailto:ewittersh...@aasmnet.org]
>
> *Sent:* Thursday, February 23, 2012 10:52 AM
> *To:* MS-Exchange Admin Issues
> *Subject:* Selective Wipe of ActiveSync devices
>
>  
>
> Good morning all,
>
>  
>
> What is everyone using for their corp. environment to do selective wipes
> of ActiveSync devices that aren’t owned by the company? I’m currently
> running Exchange 2003 SP2 with plans to upgrade to 2010 later this year.
>  With that in mind would I be better off upgrading to Exch 2010 first?
>
>  
>
> Eric Wittersheim
>
> Network Administrator
>
> American Academy of Sleep Medicine
>
> 2510 N. Frontage Road
>
> Darien, IL. 60561
>
>  
>
> Thank you for your membership support! To continue receiving the value of
> AASM membership through 2012, renew online! www.aasmnet.org
>
> {*} 
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here:
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> Confidentiality Notice:
> This e-mail, including any attachments is the
> property of Catholic Health East and is intended
> for the sole use of the intended recipient(s).
> It may contain information that is privileged and
> confidential.  Any unauthorized review, use,
> disclosure, or distribution is prohibited. If y

Re: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005

[Kurt Buff]

Not until now.



Thanks,

Kurt

On Fri, Feb 24, 2012 at 10:50, Michael B. Smith  wrote:
> Seen this?
>
> http://blogs.technet.com/b/exchange/archive/2012/02/22/calcheck-the-outlook-calendar-checking-tool.aspx
>
>
> -Original Message-
> From: Kurt Buff [mailto:kurt.b...@gmail.com]
> Sent: Friday, February 24, 2012 1:17 PM
> To: MS-Exchange Admin Issues
> Subject: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005
>
> All,
>
> I'm wondering if anyone has run into a similar situation, or has some insight 
> into what else I can do.
>
> This started about 4 days ago - I've got the above eventid logging about 
> every 5 minutes, but only for one user. Possibly important
> detail: This user is a road warrior, and is using an HTC Thunderbolt with 
> Active Sync.
>
> The very first link on google
> (http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/c275b561-7b88-4d7a-ba16-2956a88d43a1)
> discusses this exact issue, but the hotfix mentioned didn't in my case fix 
> this issue.
>
> I've applied the hotfix Exchange2003-KB943721-x86.exe, but that did not solve 
> the problem - it restarted the services, but the entries still accumulate.
>
> The error code that's listed in the event log is different than what's 
> showing in the KB article, however. I'm seeing 0x80004005, which is not 
> disucssed.
>
> Looking through the rest of the google entries, I find no better suggestions.
>
> What I'm doing now is asking him to turn off his Calendar sync for an hour, 
> and notify me when he does, so that I can check whether it's the phone that's 
> causing the issue.
>
> Kurt
>
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Selective Wipe of ActiveSync devices

[Bob Fronk]

I don't allow BYOD.  So this is not an issue.

BF



From: Eric Wittersheim [mailto:ewittersh...@aasmnet.org]
Sent: Thursday, February 23, 2012 10:52 AM
To: MS-Exchange Admin Issues
Subject: Selective Wipe of ActiveSync devices

Good morning all,

What is everyone using for their corp. environment to do selective wipes of 
ActiveSync devices that aren't owned by the company? I'm currently running 
Exchange 2003 SP2 with plans to upgrade to 2010 later this year.  With that in 
mind would I be better off upgrading to Exch 2010 first?

Eric Wittersheim
Network Administrator
American Academy of Sleep Medicine
2510 N. Frontage Road
Darien, IL. 60561

Thank you for your membership support! To continue receiving the value of AASM 
membership through 2012, renew online! www.aasmnet.org
{*}

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange 2010 Litigation hold

[Heaton, Joseph@DFG]

I ran it manually, for my mailbox, after enabling the litigation hold.

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith [mailto:mich...@smithcons.com]
Sent: Friday, February 24, 2012 11:07 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Is the MFA scheduled to run? Have you run it manually?

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Friday, February 24, 2012 1:44 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

So, 2 days later now, and I still don't have the message that I'm on litigation 
hold on the backstage screen.  Any ideas why this wouldn't have happened?

Joe Heaton
ITB - Windows Server Support

From: Joseph Heaton 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 10:14 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Awesome.  As always, thank you so very much.

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:michael@smithconscom]
Sent: Wednesday, February 22, 2012 10:09 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Quote:

Although litigation hold is processed by Exchange in that period, the 
litigation hold comment does not show up in Outlook 2010 until the MFA has 
processed the mailbox. Depending on the assistant's work cycle, it may take as 
long as 1 day (the default work cycle configuration on Exchange 2010) for the 
comment to be displayed in Outlook. To make the comment show up sooner, you can 
manually kick off the assistant against a mailbox.

Start-ManagedFolderAssistant "Mailbox User"

To have the assistant process multiple mailboxes, you'll need to pipe output 
from the Get-Mailbox cmdlet, which can use recipient filters to filter 
mailboxes, or use distribution group membership.

http://blogs.technet.com/b/exchange/archive/2011/08/16/retention-hold-and-litigation-hold-in-exchange-2010.aspx

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:56 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

I am in cached mode.  When I set the hold, I got a message saying it could take 
up to 60 minutes, but it's been a couple of hours now, I believe.  Does it show 
up at the top, after clicking the File tab, or...?

Joe Heaton
ITB - Windows Server Support

From: Michael B. Smith 
[mailto:michael@smithconscom]
Sent: Wednesday, February 22, 2012 9:41 AM
To: Heaton, Joseph@DFG; MS-Exchange Admin Issues
Subject: RE: Exchange 2010 Litigation hold

Are you in cached mode?

My memory is this can take several hours, but I haven't tested it since the 
last article I wrote on it.

From: Heaton, Joseph@DFG 
[mailto:jhea...@dfg.ca.gov]
Sent: Wednesday, February 22, 2012 12:30 PM
To: MS-Exchange Admin Issues
Subject: Exchange 2010 Litigation hold

We're running Exch 2010, SP1

In our migration efforts from Groupwise, one question that has come up is 
litigation hold.  So, I've been doing some research, and understand the 
workings of it, but I have a question about the notification.  I've placed 
myself on litigation hold, and typed in a message in the notes field.  This is 
supposed to show up in the backstage area of Outlook 2010, which I'm running as 
my client.  It's been well over an hour, and I'm not seeing anything in the 
backstage area.  Am I being blind, or is there something I haven't done 
correctly?

Joseph L. Heaton
Staff Information Systems Analyst
Windows Server Support
Information Technology Branch
Department of Fish and Game
1807 13th Street, Suite 201
Sacramento, CA  95811
(916) 323-1284


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com

RE: Exchange Attachment Size Issue

[Joseph L. Casale]

>From my experience thats the overhead that the encoding and formating add...
Constant battle with my users who use email as a file server :/

From: Benjamin Zachary [li...@levelfive.us]
Sent: Friday, February 24, 2012 12:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange Attachment Size Issue

Hi all, just an odd question. I have a client who sends out this 8.5MB pdf 
contract , they have been using it for years, recently the last couple of 
months its getting rejected as being larger than 10mb by many organizations.

I did a quick test, and I see in the logs that when the email is sent the 
transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 * 1024 = 
8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

As a test I sent it to gmail, and sent it back and it was basically the same 
11.4 million bytes. I could shrink the PDF size down as a possible option (they 
make about 30 of these per day) but was trying to figure out what would make an 
8.5MB email (no text , tried plain , rich, html) would come across as 11.4 
million (or 11 megs). My initial thought was that as people move to the cloud 
exchange and hosted apps there probably is 10 meg limits , but some of these 
are clients they do business with for years and is highly unlikely to impose 
these kind of restrictions (although I am checking).

Bottom line the client believes we did something in January to their Exchange 
2010 SP1 server that is causing this …

Any ideas appreciated …




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Exchange Attachment Size Issue

[Kurt Buff]

On Fri, Feb 24, 2012 at 11:31, Benjamin Zachary  wrote:
> Hi all, just an odd question. I have a client who sends out this 8.5MB pdf
> contract , they have been using it for years, recently the last couple of
> months its getting rejected as being larger than 10mb by many organizations.
>
>
>
> I did a quick test, and I see in the logs that when the email is sent the
> transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 *
> 1024 = 8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.
>
>
>
> As a test I sent it to gmail, and sent it back and it was basically the same
> 11.4 million bytes. I could shrink the PDF size down as a possible option
> (they make about 30 of these per day) but was trying to figure out what
> would make an 8.5MB email (no text , tried plain , rich, html) would come
> across as 11.4 million (or 11 megs). My initial thought was that as people
> move to the cloud exchange and hosted apps there probably is 10 meg limits ,
> but some of these are clients they do business with for years and is highly
> unlikely to impose these kind of restrictions (although I am checking).
>
>
>
> Bottom line the client believes we did something in January to their
> Exchange 2010 SP1 server that is causing this …
>
>
>
> Any ideas appreciated …

The reason why it's going over 10mbytes is because of the Base64
encoding of the attachment - this is very common, and your case is
actually mild - extreme cases can as much as double the expected size
of the attachment, and the usual culprit in the extreme case is binary
data, such as jpegs, etc.

No idea why it's getting rejected more now than later, unless the
recipient's orgs have gotten new appliances or cloud services that
have that 10mb limit.

Kurt

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Exchange Attachment Size Issue

[PRamatowski]

Overhead in converting to SMTP/MIME format while in transit is my guess

Blackberry

From: Benjamin Zachary [mailto:li...@levelfive.us]
Sent: Friday, February 24, 2012 02:31 PM
To: MS-Exchange Admin Issues 
Subject: Exchange Attachment Size Issue

Hi all, just an odd question. I have a client who sends out this 8.5MB pdf 
contract , they have been using it for years, recently the last couple of 
months its getting rejected as being larger than 10mb by many organizations.

I did a quick test, and I see in the logs that when the email is sent the 
transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 * 1024 = 
8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

As a test I sent it to gmail, and sent it back and it was basically the same 
11.4 million bytes. I could shrink the PDF size down as a possible option (they 
make about 30 of these per day) but was trying to figure out what would make an 
8.5MB email (no text , tried plain , rich, html) would come across as 11.4 
million (or 11 megs). My initial thought was that as people move to the cloud 
exchange and hosted apps there probably is 10 meg limits , but some of these 
are clients they do business with for years and is highly unlikely to impose 
these kind of restrictions (although I am checking).

Bottom line the client believes we did something in January to their Exchange 
2010 SP1 server that is causing this …

Any ideas appreciated …




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Outlook Delays since Exchange 2010 SP2 applied

[Michael B. Smith]

What version(s) of Outlook?

From: Alice Goodman [mailto:ali...@mckinstry.com]
Sent: Friday, February 24, 2012 2:24 PM
To: MS-Exchange Admin Issues
Subject: Outlook Delays since Exchange 2010 SP2 applied

I am having several users complaining about Outlook delays and what almost 
looks like "batched" delivery.  In their, words, "I just had another random 
delay, this time on my own mailbox. Everything appeared fine, but then all of a 
sudden several emails all appeared at the same time that were actually 
delivered 10-15 minutes ago."

I did 2 things recently, put SP2 on Feb. 3rd and added an authoritative domain 
on Feb. 11th.

My understanding is that the settings in Send/Receive do NOT impact Exchange 
users, only POP and IMAP.

Any suggestions on where to start looking?

Thanks,
Alice


Alice Goodman, MCSE, LEED(r) AP (BD+C)
P 206.832.8295 | C 206.427.7760 | F 206.374.6814
Sr. Exchange Administrator

McKINSTRY FOR THE LIFE OF YOUR BUILDING
Consulting | Construction | Energy | Facility Services

www.mckinstry.com




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[Michael B. Smith]

In general, the MIME overhead associated with a binary file is just about 33%. 
Exchange talking to Exchange transfers in binary (and there is an SMTP command 
that defines support for binary transfers - BDAT).

I don't remember any change in this in SP1, but obviously I don't remember 
everything.

Office 365 has a documented limit of 25 MB.

From: Benjamin Zachary [mailto:li...@levelfive.us]
Sent: Friday, February 24, 2012 2:32 PM
To: MS-Exchange Admin Issues
Subject: Exchange Attachment Size Issue

Hi all, just an odd question. I have a client who sends out this 8.5MB pdf 
contract , they have been using it for years, recently the last couple of 
months its getting rejected as being larger than 10mb by many organizations.

I did a quick test, and I see in the logs that when the email is sent the 
transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 * 1024 = 
8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

As a test I sent it to gmail, and sent it back and it was basically the same 
11.4 million bytes. I could shrink the PDF size down as a possible option (they 
make about 30 of these per day) but was trying to figure out what would make an 
8.5MB email (no text , tried plain , rich, html) would come across as 11.4 
million (or 11 megs). My initial thought was that as people move to the cloud 
exchange and hosted apps there probably is 10 meg limits , but some of these 
are clients they do business with for years and is highly unlikely to impose 
these kind of restrictions (although I am checking).

Bottom line the client believes we did something in January to their Exchange 
2010 SP1 server that is causing this ...

Any ideas appreciated ...




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[Jason Gurtz]

The bloat is the magic of the MIMEfield

1 != 1 once MIME encoded. It will be bigger, guaranteed. By how much is
non-deterministic. You can assume from 10%-30%+ growth in size in typical
situations.

They won't like that, but you will be off the hook. Come prepared with
different but identically sized binary files to show them the facts. Refer
them to Wikipedia and the RFCs if they are pests.

8.5MB sounds substantially larger than necessary for a contract document.
There could be billable hours in an optimization task...

~JasonG

> -Original Message-
> From: Benjamin Zachary [mailto:li...@levelfive.us]
> Sent: Friday, February 24, 2012 14:32
> To: MS-Exchange Admin Issues
> Subject: Exchange Attachment Size Issue
> 
> Hi all, just an odd question. I have a client who sends out this 8.5MB
> pdf contract , they have been using it for years, recently the last
> couple of months its getting rejected as being larger than 10mb by many
> organizations.
> 
> 
> 
> I did a quick test, and I see in the logs that when the email is sent
the
> transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 *
> 1024 = 8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.
> 
> 
> 
> As a test I sent it to gmail, and sent it back and it was basically the
> same 11.4 million bytes. I could shrink the PDF size down as a possible
> option (they make about 30 of these per day) but was trying to figure
out
> what would make an 8.5MB email (no text , tried plain , rich, html)
would
> come across as 11.4 million (or 11 megs). My initial thought was that as
> people move to the cloud exchange and hosted apps there probably is 10
> meg limits , but some of these are clients they do business with for
> years and is highly unlikely to impose these kind of restrictions
> (although I am checking).
> 
> 
> 
> Bottom line the client believes we did something in January to their
> Exchange 2010 SP1 server that is causing this ...
> 
> 
> 
> Any ideas appreciated ...
> 
> 
> 
> 
> 
> 
> 
> ---
> To manage subscriptions click here: http://lyris.sunbelt-
> software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[Mayo, Bill]

(Apologies to the smarter folks on this list if I am mangle this.)
Email works with text, not binary.  So, your email system has to convert
anything that is not text into text to be able to pass it via email.
The process encodes the binary into text, which increases the size of
it.  Back in the old days, this made for all kinds of fun with
attachments, as there was no standard type of encoding.  These days, I
think it is accurate that most everybody uses MIME.  But, yes, it is
normal that an attachment will grow when added to an email.

 

From: Joseph L. Casale [mailto:jcas...@activenetwerx.com] 
Sent: Friday, February 24, 2012 3:08 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange Attachment Size Issue

 

>From my experience thats the overhead that the encoding and formating
add...
Constant battle with my users who use email as a file server :/



From: Benjamin Zachary [li...@levelfive.us]
Sent: Friday, February 24, 2012 12:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange Attachment Size Issue

Hi all, just an odd question. I have a client who sends out this 8.5MB
pdf contract , they have been using it for years, recently the last
couple of months its getting rejected as being larger than 10mb by many
organizations. 

 

I did a quick test, and I see in the logs that when the email is sent
the transfer is over 11 million bytes . Doing some quick math 8.5MB *
1024 * 1024 = 8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

 

As a test I sent it to gmail, and sent it back and it was basically the
same 11.4 million bytes. I could shrink the PDF size down as a possible
option (they make about 30 of these per day) but was trying to figure
out what would make an 8.5MB email (no text , tried plain , rich, html)
would come across as 11.4 million (or 11 megs). My initial thought was
that as people move to the cloud exchange and hosted apps there probably
is 10 meg limits , but some of these are clients they do business with
for years and is highly unlikely to impose these kind of restrictions
(although I am checking).

 

Bottom line the client believes we did something in January to their
Exchange 2010 SP1 server that is causing this ... 

 

Any ideas appreciated ...

 

 

 

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here:
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[John Cook]

I've seen it with docx/xlsx files but not really noticed it with PDFs . If 
you're encrypting transmissions between the server and clients that could add 
to the size.

 John W. Cook
Network Operations Manager
Partnership For Strong Families
5950 NW 1st Place
Gainesville, Fl 32607
Office (352) 244-1610
Cell (352) 215-6944
MCSE, MCP+I, MCTS, CompTIA A+, N+, VSP4, VTSP4

From: Joseph L. Casale [mailto:jcas...@activenetwerx.com]
Sent: Friday, February 24, 2012 3:08 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange Attachment Size Issue

>From my experience thats the overhead that the encoding and formating add...
Constant battle with my users who use email as a file server :/

From: Benjamin Zachary [li...@levelfive.us]
Sent: Friday, February 24, 2012 12:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange Attachment Size Issue
Hi all, just an odd question. I have a client who sends out this 8.5MB pdf 
contract , they have been using it for years, recently the last couple of 
months its getting rejected as being larger than 10mb by many organizations.

I did a quick test, and I see in the logs that when the email is sent the 
transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 * 1024 = 
8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

As a test I sent it to gmail, and sent it back and it was basically the same 
11.4 million bytes. I could shrink the PDF size down as a possible option (they 
make about 30 of these per day) but was trying to figure out what would make an 
8.5MB email (no text , tried plain , rich, html) would come across as 11.4 
million (or 11 megs). My initial thought was that as people move to the cloud 
exchange and hosted apps there probably is 10 meg limits , but some of these 
are clients they do business with for years and is highly unlikely to impose 
these kind of restrictions (although I am checking).

Bottom line the client believes we did something in January to their Exchange 
2010 SP1 server that is causing this ...

Any ideas appreciated ...




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist


CONFIDENTIALITY STATEMENT: The information transmitted, or contained or 
attached to or with this Notice is intended only for the person or entity to 
which it is addressed and may contain Protected Health Information (PHI), 
confidential and/or privileged material. Any review, transmission, 
dissemination, or other use of, and taking any action in reliance upon this 
information by persons or entities other than the intended recipient without 
the express written consent of the sender are prohibited. This information may 
be protected by the Health Insurance Portability and Accountability Act of 1996 
(HIPAA), and other Federal and Florida laws. Improper or unauthorized use or 
disclosure of this information could result in civil and/or criminal penalties.
Consider the environment. Please don't print this e-mail unless you really need 
to.

This email and any attached files are confidential and intended solely for the 
intended recipient(s). If you are not the named recipient you should not read, 
distribute, copy or alter this email. Any views or opinions expressed in this 
email are those of the author and do not represent those of the company. 
Warning: Although precautions have been taken to make sure no viruses are 
present in this email, the company cannot accept responsibility for any loss or 
damage that arise from the use of this email or attachments.

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[Greg Olson]

Messages sent through SMTP could grow about 10-30 percent because of format 
conversion (MIME and UUEncode).

http://ask-leo.com/why_are_emailed_attachments_larger_than_the_original_file.html
http://searchexchange.techtarget.com/answer/Why-does-an-emails-size-increase-when-sent-externally



From: Joseph L. Casale [mailto:jcas...@activenetwerx.com]
Sent: Friday, February 24, 2012 12:08 PM
To: MS-Exchange Admin Issues
Subject: RE: Exchange Attachment Size Issue

>From my experience thats the overhead that the encoding and formating add...
Constant battle with my users who use email as a file server :/

From: Benjamin Zachary [li...@levelfive.us]
Sent: Friday, February 24, 2012 12:31 PM
To: MS-Exchange Admin Issues
Subject: Exchange Attachment Size Issue
Hi all, just an odd question. I have a client who sends out this 8.5MB pdf 
contract , they have been using it for years, recently the last couple of 
months its getting rejected as being larger than 10mb by many organizations.

I did a quick test, and I see in the logs that when the email is sent the 
transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 * 1024 = 
8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.

As a test I sent it to gmail, and sent it back and it was basically the same 
11.4 million bytes. I could shrink the PDF size down as a possible option (they 
make about 30 of these per day) but was trying to figure out what would make an 
8.5MB email (no text , tried plain , rich, html) would come across as 11.4 
million (or 11 megs). My initial thought was that as people move to the cloud 
exchange and hosted apps there probably is 10 meg limits , but some of these 
are clients they do business with for years and is highly unlikely to impose 
these kind of restrictions (although I am checking).

Bottom line the client believes we did something in January to their Exchange 
2010 SP1 server that is causing this ...

Any ideas appreciated ...




---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: Exchange Attachment Size Issue

[Don Andrews]

Yup.  We've had a 10meg limit for years and get real tired of telling those 
users that insist on trying to use email as a file transfer system that email 
attachments grow when translated to internet format (user speak) typically from 
20 to 50%.

-Original Message-
From: Kurt Buff [mailto:kurt.b...@gmail.com] 
Sent: Friday, February 24, 2012 12:14 PM
To: MS-Exchange Admin Issues
Subject: Re: Exchange Attachment Size Issue

On Fri, Feb 24, 2012 at 11:31, Benjamin Zachary  wrote:
> Hi all, just an odd question. I have a client who sends out this 8.5MB pdf
> contract , they have been using it for years, recently the last couple of
> months its getting rejected as being larger than 10mb by many organizations.
>
>
>
> I did a quick test, and I see in the logs that when the email is sent the
> transfer is over 11 million bytes . Doing some quick math 8.5MB * 1024 *
> 1024 = 8912 , but Im seeing 11.4 , 11.3 on the smtp transfer.
>
>
>
> As a test I sent it to gmail, and sent it back and it was basically the same
> 11.4 million bytes. I could shrink the PDF size down as a possible option
> (they make about 30 of these per day) but was trying to figure out what
> would make an 8.5MB email (no text , tried plain , rich, html) would come
> across as 11.4 million (or 11 megs). My initial thought was that as people
> move to the cloud exchange and hosted apps there probably is 10 meg limits ,
> but some of these are clients they do business with for years and is highly
> unlikely to impose these kind of restrictions (although I am checking).
>
>
>
> Bottom line the client believes we did something in January to their
> Exchange 2010 SP1 server that is causing this …
>
>
>
> Any ideas appreciated …

The reason why it's going over 10mbytes is because of the Base64
encoding of the attachment - this is very common, and your case is
actually mild - extreme cases can as much as double the expected size
of the attachment, and the usual culprit in the extreme case is binary
data, such as jpegs, etc.

No idea why it's getting rejected more now than later, unless the
recipient's orgs have gotten new appliances or cloud services that
have that 10mb limit.

Kurt

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: internal spam

[Mike Tavares]

1 question just to clear up some confusion on my part.

Are the actual accounts in question compromised?  (as in someone has direct 
access to the mailboxes on your server?)  or just compromised in the since that 
some spammer/hacker on the outside is spoofing an email address from your 
company that is a legit address?



From: Sharp, Kevin 
Sent: Friday, February 24, 2012 12:19 PM
To: MS-Exchange Admin Issues 
Subject: internal spam

I’m wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email…essentially an internal spam attack.

 

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

 

We notice this when the email starts piling up, and action can be taken 
then..but I’m wondering if there is some software or method that might have 
some more smarts.

 

We’ve had numerous incidents but so far….not an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

 

I’ve looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

 

Thanks

 

Kevin Sharp

 

 

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

RE: internal spam

[Sharp, Kevin]

The accounts have been compromised…usually via a phishing attempt.  So the 
entire process of the internal attack is with a valid authenticated acct.   We 
have our SMTP services set to be authenticated…the problem is looking for a 
process that we can use to identify potential accounts that are sending volumes 
of email and hopefully stop it before the pile of email gets too large. Usually 
the attack sends thousands of email to valid and nonvalid email addresses…which 
of course we don’t notice until the pile of invalid email starts to pile up.

I know..it is comical ☺.  User education has helped, but like any good phishing 
attack, it only takes one bite to cause this problem.

Thanks


Kevin

From: Mike Tavares [mailto:miketava...@comcast.net]
Sent: Friday, February 24, 2012 4:26 PM
To: MS-Exchange Admin Issues
Subject: Re: internal spam

1 question just to clear up some confusion on my part.

Are the actual accounts in question compromised?  (as in someone has direct 
access to the mailboxes on your server?)  or just compromised in the since that 
some spammer/hacker on the outside is spoofing an email address from your 
company that is a legit address?



From: Sharp, Kevin
Sent: Friday, February 24, 2012 12:19 PM
To: MS-Exchange Admin Issues
Subject: internal spam

I’m wondering how people are dealing with compromised accounts in Exchange 
sending large volumes of email…essentially an internal spam attack.

Occasionally a phishing attempt will make it past our spam software, and of 
course the odd unsuspecting user ends up with a compromised  account which 
makes a connection to the mail system via either a compromised PC or external 
connection.

We notice this when the email starts piling up, and action can be taken 
then..but I’m wondering if there is some software or method that might have 
some more smarts.

We’ve had numerous incidents but so far….not an easy way to distinguish a 
potential spam attack until after it happens, and the email starts piling up in 
the retry queue.

I’ve looked at throttling policies and some of the transport filtering, not 
sure if that will help us much.   What are others doing?

Thanks

Kevin Sharp



---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to 
listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist

Re: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005

[Kurt Buff]

Very cool.

BTW - I have determined that it's his droid that's causing the issue.

Had him turn off calendar synch for an hour, during which time there
were no error messages, and then he turned it back on again, and they
started right up, every 5 minutes.

My working theory is that he entered a calendar item on his droid on
Tuesday (when this started) and that there's something wrong with it.
I've asked him to go back to the items he might have entered that day,
delete them, and then we'll see if  the noise stops.

I'm also working on setting up access to his mailbox in a profile on
another machine, and will use this tool to take a look at his calendar
and see if I find anything there.

Kurt

On Fri, Feb 24, 2012 at 10:50, Michael B. Smith  wrote:
> Seen this?
>
> http://blogs.technet.com/b/exchange/archive/2012/02/22/calcheck-the-outlook-calendar-checking-tool.aspx
>
>
> -Original Message-
> From: Kurt Buff [mailto:kurt.b...@gmail.com]
> Sent: Friday, February 24, 2012 1:17 PM
> To: MS-Exchange Admin Issues
> Subject: Exchange 2003, EXCDO, and eventID 8206 with error 0x80004005
>
> All,
>
> I'm wondering if anyone has run into a similar situation, or has some insight 
> into what else I can do.
>
> This started about 4 days ago - I've got the above eventid logging about 
> every 5 minutes, but only for one user. Possibly important
> detail: This user is a road warrior, and is using an HTC Thunderbolt with 
> Active Sync.
>
> The very first link on google
> (http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/c275b561-7b88-4d7a-ba16-2956a88d43a1)
> discusses this exact issue, but the hotfix mentioned didn't in my case fix 
> this issue.
>
> I've applied the hotfix Exchange2003-KB943721-x86.exe, but that did not solve 
> the problem - it restarted the services, but the entries still accumulate.
>
> The error code that's listed in the event log is different than what's 
> showing in the KB article, however. I'm seeing 0x80004005, which is not 
> disucssed.
>
> Looking through the rest of the google entries, I find no better suggestions.
>
> What I'm doing now is asking him to turn off his Calendar sync for an hour, 
> and notify me when he does, so that I can check whether it's the phone that's 
> causing the issue.
>
> Kurt
>
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist
>
> ---
> To manage subscriptions click here: 
> http://lyris.sunbelt-software.com/read/my_forums/
> or send an email to listmana...@lyris.sunbeltsoftware.com
> with the body: unsubscribe exchangelist

---
To manage subscriptions click here: 
http://lyris.sunbelt-software.com/read/my_forums/
or send an email to listmana...@lyris.sunbeltsoftware.com
with the body: unsubscribe exchangelist